Browse public community intelligence reports, source analysis, and threat research.
79 intel reports
The ROMULUS delivery platform utilizes ClickFix lures and social engineering to distribute diverse payloads including LegionLoader, Atlas RAT, and RomulusLoader targeting global organizations.
CastleStealer and CastleLoader use browser protection bypasses and ClickFix social engineering to exfiltrate sensitive data and deploy secondary RATs like NetSupport.
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
Play (or Playcrypt) is a sophisticated ransomware group utilizing double extortion, custom information stealers like Grixba, and exploitation of vulnerabilities in FortiOS and Microsoft Exchange to target global organizations.
The suspected TraderTraitor group is using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware for credential theft and persistent access.
China-nexus actors UAT-11587 and UNC6384 are targeting government, diplomatic, and policy organizations across Asia and Europe using the novel Rust-based Antino backdoor and PlugX RAT via complex multi-stage infection chains.
Everest is a sophisticated .NET-based ransomware that employs aggressive lateral movement, service termination, and process self-protection while targeting Windows environments.
FomoPeek versions 1.1 and 1.2 utilized kernel exploits and sandbox escapes to steal cryptocurrency private keys and sensitive data from iOS devices.
Water Hydra (EvilNum) has transitioned from complex zero-day exploits to social engineering-driven campaigns using .PIF files and non-standard protocol handlers to deliver the DarkMe RAT.
Russian-branded ClickFix campaigns are compromising Ukrainian websites to deliver the Psychedelic infostealer and persistent remote access tools using fake CAPTCHA lures.
